The Internet Protocol ("IP") is an addressing protocol designed to facilitate the routing of traffic within a network or between networks. The Internet Protocol is used on many computer networks including the Internet, intranets and other networks. Current versions of Internet Protocol such as Internet Protocol version-4 ("IPv4") are becoming obsolete because of limited address space. With a 32-bit address-field, it is possible to assign 2.sup.32 different addresses, which is 4,294,967,296, or greater than 4 billion globally unique addresses.
However, with the explosive growth of the Internet and intranets, Internet Protocol addresses using a 32-bit address-field may soon be exhausted. Internet Protocol version-6 ("IPv6") proposes the use of a 128-bit address-field for IP addresses. However, a large number of legacy networks including a large number of Internet subnets will still be using older versions for Internet Protocol with a 32-bit address space for many years to come.
Network Address Translation ("NAT") has been proposed to extend the lifetime of Internet Protocol version 4 and earlier versions of Internet Protocol by allowing subnets to exist behind a single or small number of globally unique Internet Protocol addresses (see e.g., "The IP Network Address Translator", by P. Srisuresh and K. Egevang, Internet Engineering Task Force ("IETF"), Internet Draft &lt;draft-rfced-info-srisuresh-05.tx&gt;, February 1998). A single global Internet Protocol address is used for communication with external networks such as the Internet Internally, a sub-network ("subnet") uses local addressing. Local addressing may be either any addressing scheme that is different from Internet Protocol addressing, or a non-unique usage of Internet Protocol addresses. In either case, local addresses on a subnet are not used on the external, global Internet. When a device or node using local addressing desires to communicate with the external world, its local address is translated to a common external Internet Protocol address used for communication with an external network by a network address translation device. That is, network address translation allows one or more global Internet Protocol addresses to be shared among a larger number of local addresses.
There are several problems associated with using network address translation to extend the life of the Internet Protocol. Network address translation interferes with the end-to-end routing principal of the Internet that recommends that packets flow end-to-end between network devices without changing the contents of any packet along a transmission route (see e.g., "Routing in the Internet," by C. Huitema, Prentice Hall, 1995, ISBN 0-131-321-927).
Current versions of network address translation replace a local network address in a data packet header with an external global network address on outbound traffic, and replace an external network address in a data packet header with a local network address on inbound traffic. This type of address translation is computationally expensive, causes security problems by preventing certain types of encryption from being used, or breaks a number of existing applications in a network that cannot provide network address translation (e.g., File Transfer Protocol ("FTP")).
Current versions of network address translation may not gracefully scale beyond a small subnet containing a few dozen nodes or devices because of the computational and other resources required. Network address translation potentially requires support for many different internal network protocols be specifically programmed into a translation mechanism for external protocols in a network address translation device such as a network address translation router.
Computational burdens placed on a network address translation router may be significant and degrade network performance, especially if several network address translation-enabled sub-networks share the same network address translation router. In a worst case scenario, a network address translation router translates every inbound and outbound data packet. When network address translation is used to translate a Transmission Control Protocol/Internet Protocol or User Datagram Protocol/Internet Protocol data packet, the packet's Internet Protocol, Transmission Control Protocol or User Datagram Protocol checksums are recalculated.
As is known in the art, Transmission Control Protocol ("TCP") and User Datagram Protocol ("UDP") are often used over EP in computer networks. Transmission Control Protocol provides a connection-oriented, end-to-end reliable protocol designed to fit into a layered hierarchy of protocols that support multi-network applications. User Datagram Protocol provides a transaction oriented datagram protocol, where delivery and duplicate packet protection are not guaranteed.
When a port in a Transmission Control Protocol or User Datagram Protocol header is translated, the packet's Transmission Control Protocol or User Datagram Protocol checksums are also recalculated. This further increases the computational cost of translation in a network address translation router.
When an Internet Protocol address or port is translated with network address translation, a new length may result for the data packet and a possible change in a Transmission Control Protocol sequence number. A running sequence number offset (i.e., a delta) must then be maintained throughout the remainder of the connection. This delta must be applied to future traffic, including acknowledgment numbers further increasing computational time in a network address translation router.
In addition to Transmission Control Protocol or User Datagrain Protocol, a network address translation router may also translate network addresses, ports, change lengths and maintain sequence numbers for a number of different protocols that may use an Internet Protocol address or port number (e.g., FTP, H.323, H.324, CUSeeME, RealAudio, Internet Relay Chat and others). This translation may further increase computational time in a network address translation router.
Some of the problems associated with network address translation have been overcome with Distributed Network Address Translation ("DNAT") described in co-pending application Ser. No. 09/035,600. Distributed Network Address Translation is used with small office network, home office networks or other stub networks that have multiple network devices using a common external network address to communicate with an external network such as the Internet-Distributed Network Address Translation includes a Port Allocation Protocol to allocate locally unique ports to network devices on a stub computer network. The locally unique ports are used in a combination network address with a common external network address such as a global Internet Protocol address, to identify multiple network devices on the stub network to an external network such as the Internet, an intranet, or a public switched telephone network. Distributed Network Address Translation includes requesting one or more locally unique ports from network devices on a stub network, receiving the ports, and replacing default ports with the locally unique ports. The network devices on the local network use the combination network address with the common global external network address and the locally unique port to uniquely identify themselves during communications with an external network.
The Internet Protocol is used on global computer networks such as the Internet, and on many private networks such as intranets and Virtual Private Networks. It is often desirable to protect information sent with the Internet Protocol using different types of security. Using security with the Internet Protocol allows private or sensitive information to be sent over a public network with some degree of confidence that the private or sensitive information will not be intercepted, examined or altered.
Internet Protocol security ("IPsec") is a protocol for implementing security for communications on networks using the Internet Protocol through the use of cryptographic key management procedures and protocols. Internet Protocol security is used with Distributed Network Address Translation as is described in co-pending application Ser. No. 09/170,437. Communications between two endpoints of an Internet Protocol traffic flow are made end-to-end-secure by the Internet Protocol security protocol on an individual Internet Protocol packet-to-packet basis. Internet Protocol security protocol entities at connection endpoints have access to, and participate in, critical and sensitive operations that make a common connection secure.
Internet Protocol security currently includes two security services, each having an associated header that is added to an Internet Protocol packet that is being protected. The two security services include an Authentication Header ("AH") and an Encapsulating Security Payload ("ESP") header. The Authentication Header provides authentication and integrity protection for an Internet Protocol packet. The Encapsulating Security Payload header provides encryption protection and authentication for an Internet Protocol packet.
The Internet Protocol security protocol headers are identified in a protocol field of an Internet Protocol data packet header. The Internet Protocol security protocol header specifies the type (e.g., Authentication Header or Encapsulating Security Payload) and contains a numerical value called the Security Parameter Index ("SPI"). The Security Parameter Index together with a destination Internet Protocol address and Internet Security protocol form a unique identifier used by a receiving system to associate a data packet with a construct called a "security association." The Security Parameter Index is used by the receiving system to help correctly process an Internet Protocol packet (e.g., to decrypt it, or to verify its integrity and authenticity).
Internet Protocol security establishes and uses a Security Association ("SA") to identify a secure channel between two endpoints. A Security Association is a unidirectional session between two termination endpoints. Two termination endpoints of a single Security Association define a logical session that is protected by Internet Protocol security services. One endpoint sends Internet Protocol packets, and a second endpoint receives the Internet Protocol packets. Since a Security Association is unidirectional, a minimum of two Security Associations is required for secure, bi-directional communications. It is also possible to configure multiple layers of Internet Protocol security protocols between two endpoints by combining multiple Security Associations.
It is desirable to locate and use services on network devices on a stub network that uses Distributed Network Address Translation. However, there are several problems associated with locating and using services on a stub network that uses Distributed Network Address Translation. An internal network device on a stub network typically has only a locally routable network address and relies on Distributed Network Address Translation for communications with an external network such as the Internet. There is no easy way for an external network device on an external network to determine what internal network devices might be available on a stub network using Distributed Network Address Translation since the internal network devices have only locally routable network addresses that are not visible to an external network.
Another problem is that external network device cannot determine what services the internal network devices may be capable of providing (e.g., Telnet, Hyper Text Transfer Protocol, File Transfer Protocol, etc.). When an external application running on an external network wishes to contact a service running on an internal network device, the external application must obtain the appropriate service information. For example, the external application needs to obtain a port or other protocol parameters associated with the available service. There is no easy way to determine such information for an internal network device stub network using Distributed Network Address Translation.
Yet another problem is establishing secure communications between an external network device and an internal network device on an internal network device stub network using Distributed Network Address Translation. For example, an external network devices desires to contact an Internet Protocol security, Internet Key Exchange protocol ("IKE") service, on an internal network device in order to create an Internet Protocol Security Association. If the Internet Key Exchange protocol implementations on the two network devices can communicate, they can establish Security Associations and their associated Security Parameter Indexes, which will allow packets to be securely routed between the two network devices. Furthermore, if the external network device can obtain a port associated with a service running on an internal network device, it can use this port information to contact the service and establish a Security Association. There is no easy way to determine what security services night be available on a stub network using Distributed Network Address Translation.
Thus, it desirable to allow an external network device to locate and/or communicate with services on internal network devices on a stub network using Distributed Network Address Translation. It is also desirable to allow secure communications between an internal network device on a stub network using Distributed Network Address Translation and an external network device on an external network such as the Internet using Internet Protocol security and other security protocol.